Video Surveillance Laws in Indiana: A Compliance Reference for Security Teams

Video surveillance laws in Indiana can expose organizations and personnel to criminal and civil consequences. Regulatory consequences may also apply. Security teams operating Indiana sites need a careful legal and operational review before deploying cameras or changing surveillance systems.

Key Takeaways

• Knowingly or intentionally using a camera to peep into restrooms, showers, baths, and dressing rooms without consent can constitute felony voyeurism.
• Security teams should confirm who owns or controls the property and obtain consent before mounting cameras in leased spaces or on contractor premises.
• Organizations covered by the Indiana Consumer Data Protection Act must obtain consent before processing biometric data for unique identification and perform impact assessments for high-risk uses, subject to statutory scope and exemptions.
• A documented field-of-view survey, disabled audio, written retention schedules, and logged footage access give security teams a defensible compliance record.

How Indiana Regulates Video Surveillance

Indiana law combines criminal restrictions on certain camera uses with data-processing duties for some covered businesses. The Indiana Consumer Data Protection Act (INCDPA) governs some processing by covered businesses. The INCDPA, Indiana Code (IC) 24-15, took effect on January 1, 2026.

Where Cameras Are Permitted and Prohibited

Knowingly or intentionally using a camera to peep into an area where an occupant reasonably can be expected to disrobe, expressly including restrooms, baths, showers, and dressing rooms, can constitute a Level 6 felony under the voyeurism statute. Field-of-view surveys should exclude these areas, even when unoccupied. The same statute criminalizes recording a person's private area without consent and with intent to arouse or satisfy sexual desires, and it separately addresses knowing publication or transmission of an image taken in violation of the voyeurism law.

The private-property surveillance rule, IC 35-46-8.5-1, adds a Class A misdemeanor for knowingly or intentionally placing a camera or electronic surveillance equipment on another person's private property without the consent of the property owner or user. In multi-tenant facilities, teams should confirm who owns or controls the property and obtain consent before mounting a camera inside leased space or on a contractor's premises. For cameras in business common areas, including entrances, parking lots, sales floors, and warehouses, teams should document purpose, notice, field of view, and compliance with the restrictions above.

Workplace Surveillance and Employee Privacy Laws in Indiana

Workplace video surveillance in Indiana can implicate the general criminal statutes and tort law. Federal labor law may also apply. Monitoring decisions should account for business purpose, notice, location, and employee privacy. Under Indiana's privacy tort standard, an intrusion must involve private physical space and be offensive or objectionable to a reasonable person. Claims involving public or common work areas therefore present different considerations from surveillance in private places.

Federal labor law adds constraints. Depending on context, recording protected concerted activity or creating the impression of surveillance can violate federal labor law if it interferes with employees' exercise of protected rights. Unionized employers should include those protected-rights constraints in the review before installing cameras or changing how footage is used.

Notice and Signage Requirements

Notice is an important part of surveillance planning. The Indiana criminal statutes focus on prohibited conduct, consent, and surveillance location. Even if a general notice rule doesn't apply to a particular deployment, notice remains important in practice.

A handbook disclosure covering monitored areas, business justification, footage access, and system configuration, backed by signed employee acknowledgment, can create a stronger internal notice record than signage alone, but it does not replace labor-law analysis, safeguards for protected activity, or collective-bargaining obligations.

Practitioners responsible for multi-state portfolios can compare Indiana's requirements against other jurisdictions in this state-by-state reference.

Data Privacy and Storage Obligations

Covered organizations must consider how they process and store footage. The INCDPA applies to for-profit entities processing personal data of Indiana residents above volume thresholds set in the statute, and it excludes employee and business-to-business data from scope.

Biometric identifiers generated by automatic measurement of biological characteristics, such as faceprints derived from footage, are sensitive data requiring opt-in consent before processing and impact assessments for high-risk uses. The Attorney General exclusively enforces the INCDPA, which provides no private right of action and permits penalties up to $7,500 per violation after a statutory cure period.

Federal Overlays for Indiana Sites

Federal requirements may also apply in defined settings. Within its defined federal jurisdiction, the Video Voyeurism Prevention Act, 18 U.S.C. § 1801, makes capturing images of a person's private area without consent a federal misdemeanor where a reasonable expectation of privacy exists. A restroom camera may therefore violate federal and state law simultaneously when the jurisdictional requirements and other statutory elements are met.

In healthcare facilities, footage maintained as electronic protected health information falls under the Health Insurance Portability and Accountability Act (HIPAA) Security Rule.

The Security Rule's physical safeguards require access limits for systems that store that footage. As a risk-based compliance practice, keep cameras out of exam rooms and other patient-privacy areas, and assess privacy and security risks before installation.

Practical Compliance Steps for Security Teams

Footage containing biometric identification data used for unique identification may fall under the breach notification law, IC 24-4.9. That law requires reasonable safeguards and can obligate database owners to notify affected residents within 45 days of discovering a covered breach, with concurrent notice to the Attorney General.

• Map every camera field of view against the prohibited-area list before installation and keep the survey in the compliance file. Incidental capture of a restroom or changing room creates serious risk and must be assessed under the statute's knowledge, intent, and peeping elements.
• Document the business purpose for each camera, identify monitored areas in workplace policies, and keep records of the applicable notice process.
• Adopt a written retention schedule with a litigation-hold override, and suspend auto-deletion when the organization receives notice of a potential claim.
• Restrict footage review by role, log each access with identity and purpose, and use encryption at rest and in transit as a recommended measure supporting the reasonable-safeguard duties in IC 24-4.9.

Building a Defensible Surveillance Program in Indiana

A defensible Indiana surveillance program depends on documented, current compliance records. Teams should keep field-of-view surveys and configuration records current, then revisit the compliance analysis whenever camera placement or analytics capabilities change. That review helps identify new privacy and data-handling risks before deployment.

Frequently Asked Questions

What are the volume thresholds that determine whether a business is covered by the Indiana Consumer Data Protection Act (INCDPA) for video surveillance purposes?

The INCDPA applies to for-profit entities controlling or processing personal data of at least 100,000 Indiana consumers annually, or controlling or processing data of at least 25,000 consumers while deriving over 50 percent of gross revenue from selling personal data.

Can Indiana employers use facial recognition technology on workplace security cameras without employee consent, and what are the legal consequences?

The Indiana Consumer Data Protection Act requires consent to process sensitive data such as biometric data used to uniquely identify a consumer, but it generally excludes data processed in an employment context. The Indiana Consumer Data Protection Act requires covered controllers to conduct impact assessments for certain high-risk processing, including some processing of sensitive data such as biometric data, but this should not be framed as a verified requirement for employers processing employee faceprints without confirming the statute's employment-data scope. The Attorney General can impose penalties up to $7,500 per violation after a cure period.

How should security teams handle video surveillance in multi-tenant buildings in Indiana to avoid violating the private-property surveillance rule?

Security teams must identify who owns or controls each area, then obtain written consent from the property owner or authorized user before installing cameras in leased tenant spaces or contractor-controlled premises, documenting both consent and business justification.